GCP: Permission Denied on Connection

When connecting a GCP project, you may see this error during the Verify Connection step or after setup:

PERMISSION_DENIED: unable to impersonate: Permission
'iam.serviceAccounts.getAccessToken' denied on resource
(or it may not exist).

This means the impersonation binding between SecureSlate's scanner and your service account was not applied during setup, even if the setup script printed "Setup complete."

What causes this

The setup script runs several steps. If the impersonation binding step failed (for example, due to insufficient permissions in Cloud Shell), the script may have continued without stopping, making it appear that setup succeeded.

The fix is to run just that one binding command manually.

What you'll need

• Access to Google Cloud Shell for your GCP project
• The SecureSlate Scanner Service Account email. You can copy this from the setup script shown in Integrations → Google Cloud Platform → Configuration → Step 2
• Your GCP project ID (the same one you entered in Step 1 of the wizard)

Fix: re-apply the impersonation binding

Step 1: Open Cloud Shell

Go to console.cloud.google.com and click the Cloud Shell icon in the top-right toolbar.

Step 2: Run the binding command

In Cloud Shell, run the following. Replace the two placeholders:

• YOUR_SA_EMAIL: the service account email shown in the SecureSlate setup script (e.g. secureslate@your-project.iam.gserviceaccount.com)
• YOUR_PROJECT_ID: your GCP project ID
• SCANNER_SA_EMAIL: the SecureSlate scanner service account email, copied from the setup script in Step 2 of the wizard

gcloud iam service-accounts add-iam-policy-binding YOUR_SA_EMAIL \
  --project=YOUR_PROJECT_ID \
  --role="roles/iam.serviceAccountTokenCreator" \
  --member="serviceAccount:SCANNER_SA_EMAIL"

A successful run outputs something like:

Updated IAM policy for service account [secureslate@your-project.iam.gserviceaccount.com].

Step 3: Wait ~60 seconds

GCP IAM changes take up to 60 seconds to propagate. Wait before moving to the next step.

Step 4: Verify in SecureSlate

Go back to Integrations → Google Cloud Platform → Configuration, re-enter your project ID and service account email on Step 3, and click Verify Connection. The error should be gone.

If you see PERMISSION_DENIED running the command

Your Cloud Shell user account doesn't have iam.serviceAccountAdmin on the project. Ask your GCP project owner to run the same command. It only takes a minute and doesn't require any changes to SecureSlate.

Still not working?

If verification continues to fail after following the steps above, check that:

• The service account email you entered in SecureSlate exactly matches the one in your GCP project (no typos, same project ID)
• The service account exists in the correct GCP project. Run gcloud iam service-accounts list --project=YOUR_PROJECT_ID to confirm
• You waited at least 60 seconds after running the command before retrying

If none of the above resolves the issue, contact SecureSlate support and include your GCP project ID and the exact error message.